Privacy Policy

• Account info — when you sign in with Google, we receive your name, email address, and profile picture from your Google account.
• Project data — anything you or your collaborators add to a project: budgets, schedules, crew lists, call sheets, contracts, comments, board items, and uploaded files.
• Usage data — basic logs (IP address, browser, timestamps) needed to operate and secure the Service.
• Email content — if you connect a Google account to ingest email (e.g. for project pulse or W-9 intake), we read message metadata and attachments matching your configured filters. We do not read mail outside that scope.

• To provide the Service: authenticate you, render your projects, send invitation and notification emails.
• To operate features you turn on (email ingest, calendar pulse, document parsing).
• To debug, secure, and improve the Service.

We do not sell your data. We do not use your project content or email content to train AI models that serve other customers.

We use a small set of sub-processors to run the Service:

• Supabase — database, authentication, file storage
• Vercel — hosting and deployment
• Resend — transactional email delivery
• Google — OAuth sign-in; Gmail and Calendar access if you connect them
• Anthropic — AI processing for document parsing (e.g. W-9 vision extraction)

We share the minimum data needed for these vendors to do their job. We do not share your data with advertisers.

The App’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google account data only to authenticate you and to power features you explicitly enable.

We keep project data for as long as your account is active. If you ask us to delete your account, we delete your personal data and your project content within 30 days, except where we are required to retain records (e.g. signed contracts, financial records) for legal or tax reasons.

• Access, correct, or export your data — email us and we’ll help.
• Delete your account and your data — same.
• Disconnect Google access — revoke at myaccount.google.com/permissions any time.

We use TLS in transit, encryption at rest via our hosting providers, and role-based access controls in the database. No system is perfectly secure, but we treat your data carefully.

If we make material changes, we’ll update the effective date and notify users where appropriate.

Questions, requests, or concerns: ben@covalentstudios.co
Covalent Creative Productions and Studio, LLC